This file has been sitting in my C drive for the past few hours, how the heck do I get rid of it, its really been bothering me, It cannot be deleted, read of moved, I read on another website that it is a file used by people who fish on computers to find passwords and bank information, So If anyone could give me the advice and steps I need to remove this defiant little file that would be much appreciated.
Thanks, Josh.
You need to download HJT and post the log HijackThis.
Click the "Save" button.
Please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT).
You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT.
Open HijackThis and select: Do a system scan and save a log file.
When the scan is finished, Click Edit> Select All> Edit> Copy> and paste its contents here [Add Reply].
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab. Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders." Clear "Hide protected operating system files."
Click Apply, and then click OK.
Open the HijackThis Folder. Find the file HijackThis.exe, Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.
Buy yeah, what the heck is the Check_LSA7 File, would you explain to me what on earth this little .txt file is, and is it the reason why my PC is running a little chuggy lately?
It is important to note that you should only have one firewall installed at a time, but you can download to your Desktop and install each in turn to see which one you prefer.
Empty Recycle Bin
Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment
Okay, well, yes the Check_LSA7 is in the C:\ Drive, it just sits outside of all the folders, its exact location is C:\Check_LSA7, I do have a firewall, it is the firewall provided with Window SP2. I will get the AV programs and provide you with the new log file in just a couple of minutes.
Okay, at the moment AVG is performing a virus scan, using its updated information base or whatever.
Well then, basically, a few days ago my computer was hit by a serious spyware attack, and my computer was accessed by someone.
I immediatley disconnected it from the internet and tried to remove all the offending files, but unfortunatley I couldn't, and I was forced to perform a complete system reformat.
Well as you can see, a new problem has arisen, last night I was on a website called projectplaylist.com looking at music when the computer began to run slow, I went into add remove programs and removed all the ad files that had been installed. That was when I noticed that the same file that had been there when I was attacked the first time, had made its second appearance.
I'm doing all that I can to avoid another system reformat, and the conditions of my PC now are no where as to where they were before. The only thing that I have noticed is that the computer is running slightly slower than it used to, slow response times on buttons, Mozilla Firefox takes forever to start up and some programs that I use also take a moment or two to start up. I'm looking for the solution to this, I run programs like Ad-Aware 2007 on a regular basis to remove any threats, but this one stays there, I am unable to edit, delete, and move Check_LSA7 and its bothering me as I am doing all that I can to avoid what had happened before.
Doesn't surprise me. Let the scan do it's thing and we'll see what we have. Be sure to delete any virus' it finds.
Don't try any fixes by yourself.
By the way, these are bad: I think a version of the Vundo infection.
O2 - BHO: 0 - {29DD30AA-F510-4BAE-4794-33DEAD4908E2} - C:\Program Files\Windows NT\rybimovap228.dll
O2 - BHO: (no name) - {85712646-8A2D-4860-8B2A-A7A701016CF0} - C:\WINDOWS\System32\mlljj.dll
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\qvhdemtb.dll
On another note: Windows Firewall only checks items coming in.
If you already have a bad guy that calls home to a remote server, Windows Firewall won't even see that.
